seaworthycode 1.2.20 → 1.2.21

package/dist/index.js

@@ -471,6 +471,9 @@ var CHECK_PRECEDENCE = {
   "configuration.default-credentials": 1
 };
 var CROSS_DEDUPE_CHECK_IDS = new Set(Object.keys(CHECK_PRECEDENCE));
+var SUPERSESSION_RULES = [
+  { winner: "security.taint-xss", loser: "security.xss-surface" }
+];
 function crossCheckKey(finding) {
   return `${finding.file ?? ""}:${finding.line ?? 0}`;
 }
@@ -511,7 +514,23 @@ function dedupeCrossCheck(findings) {
     }
     mergedCrossFindings.push(winner);
   }
-  return [...otherFindings, ...mergedCrossFindings];
+  let result = [...otherFindings, ...mergedCrossFindings];
+  if (SUPERSESSION_RULES.length > 0) {
+    const supersededKeys = /* @__PURE__ */ new Set();
+    for (const rule of SUPERSESSION_RULES) {
+      for (const f of result) {
+        if (f.checkId === rule.winner && f.file != null && f.line != null) {
+          supersededKeys.add(`${rule.loser}:${f.file}:${f.line}`);
+        }
+      }
+    }
+    if (supersededKeys.size > 0) {
+      result = result.filter(
+        (f) => f.file == null || f.line == null || !supersededKeys.has(`${f.checkId}:${f.file}:${f.line}`)
+      );
+    }
+  }
+  return result;
 }
 var SEVERITY_ORDER = {
   critical: 0,
@@ -1083,6 +1102,7 @@ var copy = {
   // Remediation hints
   "remediation.security.hardcoded-secrets": "Move this value to an environment variable and reference it via process.env.",
   "remediation.security.dangerous-eval": "Avoid eval(), exec(), and new Function(). Use safer alternatives like JSON.parse for data parsing, or refactor to eliminate dynamic code execution.",
+  "checks.committed-env.env-message": (commit, refs) => `A .env file (other than .env.example) is tracked in git history (commit ${commit.slice(0, 7)}${refs ? `, refs: ${refs}` : ""}). Rotate any exposed secrets immediately.`,
   "remediation.security.committed-env": "Add .env to .gitignore. If the file is already tracked, use git rm --cached to untrack it without deleting, or rotate any exposed secrets.",
   "remediation.security.auth-missing-endpoints": "Apply authentication middleware to this route handler. Use requireAuth, passport, JWT verification, or session-based auth.",
   "remediation.security.cors-too-permissive": "Restrict Access-Control-Allow-Origin to your specific frontend domains rather than using a wildcard.",
@@ -1783,6 +1803,39 @@ function pathsUnderTarget(topLevel, targetDir, repoRelativePath) {
 function isInsideGitRepo(dir) {
   return gitTopLevel(dir) !== null;
 }
+function findFileInGitHistory(dir, pattern) {
+  const topLevel = gitTopLevel(dir);
+  if (!topLevel) {
+    return { found: false };
+  }
+  try {
+    const output = execSync(
+      'git log --all --format="%H|%D" --name-only --diff-filter=A',
+      {
+        cwd: dir,
+        stdio: "pipe",
+        encoding: "utf-8",
+        maxBuffer: 10 * 1024 * 1024
+      }
+    );
+    let currentCommit = "";
+    let currentRefs = "";
+    for (const line of output.split(/\r?\n/)) {
+      if (line.length >= 40 && line[40] === "|" && /^[0-9a-f]{40}$/.test(line.slice(0, 40))) {
+        currentCommit = line.slice(0, 40);
+        currentRefs = line.slice(41).trim();
+        continue;
+      }
+      if (!line.length) continue;
+      if (pathsUnderTarget(topLevel, dir, line) && pattern.test(line)) {
+        return { found: true, commit: currentCommit, refs: currentRefs };
+      }
+    }
+    return { found: false };
+  } catch {
+    return { found: false };
+  }
+}
 function hasFileInGitHistory(dir, pattern) {
   const topLevel = gitTopLevel(dir);
   if (!topLevel) {
@@ -4362,6 +4415,13 @@ function lineMatch(line, lineIndex, pattern) {
 function hasShellValidation(content) {
   return /\[\[\s*"?\$\d+"?\s*=~\s*\^/.test(content) || /\bcase\s+(?:"?\$\d+"?|"?\$\{[1-9][0-9]*(?::-[^}]*)?\}"?)\s+in\b/.test(content) || /\[\[\s+-[nz]\s+"?\$\d+"?\s*\]\]/.test(content);
 }
+function isInsideSingleQuotes(line, charIndex) {
+  let inside = false;
+  for (let i = 0; i < charIndex; i++) {
+    if (line[i] === "'") inside = !inside;
+  }
+  return inside;
+}
 function shellLineHasTimeout(line) {
   return /^\s*timeout\s+\S+/.test(line) || /(?:^|\s)(?:--max-time|--connect-timeout|--timeout|-m)(?:\s|=|$)/.test(line);
 }
@@ -4449,23 +4509,24 @@ registry.register({
   severity: "high",
   minTier: "free",
   async run(ctx) {
-    const hasEnv = hasFileInGitHistory(
+    const envMatch = findFileInGitHistory(
       ctx.targetDir,
       /(?:^|\/)\.env(?:$|\.(?!example$).+)/
     );
     const hasSettings = await hasCommittedSettingsWithSecrets(ctx.targetDir);
     const hasJavaConfig = await hasCommittedJavaConfigWithSecrets(ctx.targetDir);
-    if (!hasEnv && !hasSettings && !hasJavaConfig) return [];
+    if (!envMatch.found && !hasSettings && !hasJavaConfig) return [];
     const findings = [];
-    if (hasEnv) {
+    if (envMatch.found) {
       findings.push({
         id: "committed-env-1",
         checkId: "security.committed-env",
         category: "security",
         severity: "high",
-        message: "A .env file (other than .env.example) is tracked in git history. Environment files should never be committed.",
+        message: getCopy("checks.committed-env.env-message", envMatch.commit, envMatch.refs),
         confidence: "high",
-        remediation: getCopy("remediation.security.committed-env")
+        remediation: getCopy("remediation.security.committed-env"),
+        properties: { commit: envMatch.commit, refs: envMatch.refs }
       });
     }
     if (hasSettings) {
@@ -4490,7 +4551,7 @@ registry.register({
         remediation: getCopy("remediation.security.committed-env")
       });
     }
-    if (hasEnv) {
+    if (envMatch.found) {
       const sourceFindings = await scanBashLines(ctx, {
         checkId: "security.committed-env",
         category: "security",
@@ -5105,7 +5166,7 @@ registry.register({
     }
     if (lockfiles.length === 0) {
       try {
-        const output = execSync2("npm audit --json", {
+        const output = execSync2("npm audit --json --omit=dev", {
           cwd: ctx.targetDir,
           stdio: "pipe",
           encoding: "utf-8",
@@ -5128,7 +5189,7 @@ registry.register({
     for (const lockfile of lockfiles) {
       const lockfileDir = join8(ctx.targetDir, dirname2(lockfile));
       try {
-        const output = execSync2("npm audit --json", {
+        const output = execSync2("npm audit --json --omit=dev", {
           cwd: lockfileDir,
           stdio: "pipe",
           encoding: "utf-8",
@@ -6985,7 +7046,10 @@ async function scanBashNoInputValidation(ctx) {
     remediation: getCopy("remediation.resilience.no-input-validation")
   }, (line, content, index) => {
     if (hasShellValidation(content)) return null;
-    return lineMatch(line, index, /\$\d\b|\$\{[1-9][0-9]*\}/);
+    const match = lineMatch(line, index, /\$\d\b|\$\{[1-9][0-9]*\}/);
+    if (!match) return null;
+    if (isInsideSingleQuotes(line, match.column - 1)) return null;
+    return match;
   }).then((findings) => findings.slice(0, 1));
 }
 registry.register({